crabbox
Pass
Audited by Gen Agent Trust Hub on Jul 13, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands on remote environments via the
crabboxandblacksmithCLI tools. This includes running tests, managing Docker containers, and performing CI-parity checks, which is the stated primary purpose of the tool. - [EXTERNAL_DOWNLOADS]: The skill provides instructions to install the
crabboxCLI from a vendor-owned Homebrew tap (openclaw/tap/crabbox). This is a standard installation procedure for the vendor's tooling. - [CREDENTIALS_UNSAFE]: The documentation references authentication via a coordinator token (
CRABBOX_COORDINATOR_TOKEN) and describes a secure method of piping the environment variable into the login command rather than hardcoding credentials. - [DATA_EXFILTRATION]: Network operations are directed towards the vendor's coordinator API (
crabbox.openclaw.ai) and established infrastructure providers (AWS, Hetzner, Blacksmith). No unauthorized or suspicious data exfiltration patterns were identified.
Audit Metadata